The Threat Modeling Manifesto

Threat Modeling: Designing for Security

Threat Modeling

Securing Systems: Applied Security Architecture and Threat Models

Risk Centric Threat Modeling: Process for Attack Simulation and Threat Analysis

Threat Modeling: A Practical Guide for Development Teams

Designing Usable and Secure Software with IRIS and CAIRIS

Threat Modeling, or Architectural Risk Analysis by Coursera

Threat Modeling Workshop by Robert Hurlbut

Rapid Threat Model Prototyping (RTMP)

Methodology to create quick threat models (1) add threat metadata describing the threats and mitigations directly to software diagrams using 11 simple and repeatable steps (2) integrate these steps into Agile workstreams (3) how to best use the outputs of a threat model (Threats & Mitigations)

Threat Modeling Security Fundamentals

Threat Modeling the Right Way for Builders Workshop

AWS Skill Builder threat modeling workshop. Requires AWS Skill Builder Login (free).

Certified Threat Modeling Professional by Practical DevSecOps

DevSecOps Expert by Practical DevSecOps

Threat Modeling Fundamentals

CyberSec First Responder: Threat Detection & Response CFR210

Learning Threat Modeling for Security Professionals

Threat Modeling: Spoofing In Depth

Threat Modeling: Tampering in Depth

Threat Modeling or Whiteboard Hacking training

Kubernetes Threat Modeling

Introduction, Threat Models

Creating a Threat Model using TMT 2016

Using Threat Modeling

Threat Modeling in 2019

Threat Modeling Toolkit

Adaptive Threat Modelling

Threat modeling

Threat Model Every Story: Practical Continuous Threat Modeling Work for Your Team

Threat Modeling for Secure Software Design

Fixing Threat Models with OWASP Efforts

Designing for Security through Threat Modelling

Unlocking Threat Modeling

An Agile Approach to Threat Modeling for Securing Open Source Project EdgeX Foundry

Threat Modeling 101 (SAFECode On Demand Training Course)

ISO/SAE 21434 by Example

Introduction to Threat Modeling by Avi Douglen

Look, there's a threat model in my DevOps

Lessons from the threat modeling trenches

AWS Summit - How to approach threat modelling

Threat Modeling: What, Why, and How?

Threat Modeling: 12 Available Methods

What Is Security Threat Modeling?

Threat-modeling CheatSheet By Owasp

Threat Modeling in the Enterprise

Approachable threat modeling

Threat Modeling for Dummies

DevSecOps, Threat Modeling and You: Get started using the STRIDE method

Threat Modeling: The Why, How, When and Which Tools

Threat-modeling datasheet

Threat Modeling blog

Threat Modeling: 6 Mistakes You are Probably Making

How to Create a Threat Model for Cloud Infrastructure Security

Why You Should Care About Threat Modelling

Benefits of Threat Modeling

Threat Modeling: a Summary of Available Methods Whitepaper

Threat Modelling Toolkit

How to get started with Threat Modeling, before you get hacked

Thread Modeling tutorial

How to analyze the security of your application with threat modeling

Tactical Threat Modeling

The Power of a Tailored Threat Model Whitepaper

7 Easy Steps For Building a Scalable Threat Modeling Process

Where is my Threat Model?

Secure Slack bot an exercise in threat modeling

Secpillars.com Threat Modeling blog posts

Threat Modeling Process

Developers Guide Securing Mobile Applications

Finding Vulnerabilities In Swiss Posts

Threat Matrix CI/CD

Top 10 CI/CD Security Risks

ECS Fargate Threat Modeling

Kubernetes Attack Trees

The Enchiridion of Impetus Exemplar: A Threat Modeling Field Guide

Leveraging Threat Modeling for your SOC/SIEM

DNS Security: Threat Modeling DNSSEC, DoT, and DoH

OAuth 2.0 Threat Model and Security Considerations

Known threats using OAuth 2.0 / OpenID Connect and countermeasures.

SSL Threat model by Qualys

Email Encryption Gateway Threat model by NCC Group

OWASP Threat Model Cookbook

Kubernetes Threat Model

ISO/SAE 21434 Annex G Example

Secure Trusted Firmware for ARM processors

Docker Threat Model

Container Threat Model

Account Takeover Threat Model

Amazon S3

Playbook for Threat Modeling Medical Devices

Threat Modeling Trinity

Curated list of public penetration test reports released by several consulting firms and academic security groups.

Threat Modeling Contact Tracing Applications

Secure Password Storage

Human Threat Model

Smart Home Threat Model

IETF Trans Threat Analysis

OpenSSF CII Threat Models for Open Source Projects (as part of Silver badge criteria)

ROS 2 Robotic System

IoT Devices

ECS Fargate Threat Modeling

Bitcoin

OWASP Threat Dragon

An online threat modelling web application including system diagramming and a rule engine to auto-generate threats/mitigations.

Microsoft Threat Modeling Tool

Microsoft Threat Modeling Tool 2016 is a tool that helps in finding threats in the design phase of software projects.

Owasp-threat-dragon-gitlab

This project is a fork of the original OWASP Threat Dragon web application by Mike Goodwin with Gitlab integration instead of GitHub. You can use it with the Gitlab.com or your own instance of Gitlab.

Raindance

Project intended to make Attack Maps part of software development by reducing the time it takes to complete them.

Threatspec

Threatspec is an open source project that aims to close the gap between development and security by bringing the threat modelling process further into the development process.

PyTM

PyTM is an open source project providing a library for threat modeling with code. Describe your system using OO syntax (object.property = value) and have your threat modeling report automatically generated. 100+ threats currently supported.

MAL

MAL is an open source project that supports creation of cyber threat modeling systems and attack simulations.

Threagile

Threagile is an open-source toolkit for agile threat modeling

TicTaaC

Threat modeling-as-a-Code in a Tick (TicTaaC). Lightweight and easy-to-use Threat modeling solution following DevSecOps principles

Threat Modeling Online Game

Online version of the Elevation of Privilege and Cornucopia card games. The easy way to get started with threat modeling.

Deciduous

A web app that simplifies building attack decision trees. Hosted at https://www.deciduous.app/

drawio-threatmodeling

A collection of custom libraries to turn the free and cross-platform Draw.io diagramming application into the perfect tool for threat modeling.

Irius risk

Iriusrisk is a threat modeling tool with an adaptive questionnaire driven by an expert system which guides the user through straight forward questions about the technical architecture, the planned features and security context of the application.

SD elements

Automate Threat Modeling with SD Elements.

Foreseeti

SecuriCAD Vanguard is an attack simulation and automated threat modeling SaaS service that enables you to automatically simulate attacks on a virtual model of your AWS environment.

Tutamen Threat Model system

This tool allows threat model metadata to be added to any software diagram, turning that diagram into a threat model. It's simple to use, requires no lock-in license, and is driven by the Common Weakness Enumeration, STRIDE and OWASP Top 10.

YAKINDU Security Analyst

YAKINDU Security Analyst is a model-based software tool for threat analysis and risk assessment of technical systems. You can identify your protection needs, analyze possible threats and calculate the resulting risks. The underlying assessment model and calculation logic are highly customizable…